> 1. copy to hard disk
> 2. buy a new drive every year and copy it forward
> 3. store a copy with relatives
Yep, always good to have a local copy.
> Note that a cloud provider:
>1. can shut off your access at any time, by accident or on purpose, and you have no recourse
Absolutely, which is why steps 1-3 help here.
> 2. will sell your data to anyone at any time
Not true. Neither Google, Amazon or Microsoft do this. The current privacy policies state that. If you want to be extra cautious, you can create a cloud storage account or an account with personal domain and their privacy policies are even strong. Imaging Google or Microsoft "selling" a business's images in Photos or Drive.
> 3. will give it to any government for the asking
Unfortunately, true.
> 4. will leak it to any hacker
Will leak it is a bit too strong and harsh. 'Could be leaked' is better. Although, I have a basic trust in their security as opposed to not even using their services for this fear. Of course, I would never upload any 'private' or 'confidential' images there.
> 5. will allow employees of said cloud provider to browse your data
Again, false. 'Will' here is too strong. None of the employees have direct access to your data -- neither emails, nor images. And if you want to be even more confident, go for Google Suite or Microsoft 365 account and this is guaranteed to not happen.
> 6. will scan it to use it to sell you ads
True, but you could mitigate it by using the paid tier accounts.
> 7. will scan it looking for anything they don't approve of this week, and take "corrective action"
No arguments here -- although the paid tier accounts should guarantee this does not happen.
> 8. if you've got terabytes, good luck trying to download it
The better solution is to keep a local copy using steps 1-3 and also upload them to "your chosen service".